From: Brian Candler <b.candler@...>
Date: 2010-07-12T17:54:04+09:00
Subject: Re: How to pass a hash as a param to a method called through eval?

Alex Stahl wrote:
> So my original question probably should have been, "is eval even the
> right tool for this?".  Of course, that's not always obvious considering
> there's always more than one way to do something in ruby.

Certainly. You should also be aware that 'send' is also not without its 
security problems:


$ irb --simple-prompt
>> RUBY_DESCRIPTION
=> "ruby 1.8.7 (2010-01-10 patchlevel 249) [x86_64-linux]"
>> foo = "system"
=> "system"
>> bar = "rm /tmp/nonexistent*"
=> "rm /tmp/nonexistent*"
>> send(foo,bar)
rm: cannot remove `/tmp/nonexistent*': No such file or directory
=> false


$ irb19 --simple-prompt
>> RUBY_DESCRIPTION
=> "ruby 1.9.2dev (2009-07-18 trunk 24186) [i686-linux]"
>> foo = "system"
=> "system"
>> bar = "rm /tmp/nonexistent*"
=> "rm /tmp/nonexistent*"
>> send(foo,bar)
rm: cannot remove `/tmp/nonexistent*': No such file or directory
=> false


So it may be a good idea to give all your callable methods a prefix 
("do_xxx"), and/or only call public methods:

send(foo,bar) if respond_to?(foo)
-- 
Posted via http://www.ruby-forum.com/.